Better privacy by fragmenting SNI clientHello

[heri16]

Implement better privacy of tlsrouter by fragmenting SNI clientHello. This should prevent high-traffic DPI snooping.

Add feature to use regex capture groups for dynamic routing.

Both features used together can circumvent some forms of censorship by ISP.

Breakdown

• [x] Add tcp fragmentation / segmentation of clientHello for better privacy (enabled by default)
• [x] Expand regex capture groups for dynamic routing. See below.

Example config:

/(.+)\.oca\.nflxvideo\.net$/    $1.oca.nflxvideo.net:443
/(?P<subdomain>.+)\.oca\.nflxvideo\.net$/    ${subdomain}.oca.nflxvideo.net:443

[bradfitz]

The new regexp functionality would require tests.

What's with the unrelated DNS changes?

What is your threat model for "high-traffic DPI snooping"? The flag docs for the new hello-mss option don't say what value somebody would want, or how to disable it.

[heri16]

I've made all these optional features disabled by default.

An explanation on how to use these features: https://gist.github.com/heri16/5e7a54190287103905622c23aaf884ca